# Bug : stse_KEK_wrap cause Hard Fault Error #109

static stse_ReturnCode_t stse_KEK_wrap(
    stse_Handler_t *pSTSE,
    stse_session_t *pSession,
    PLAT_UI8 *pPayload,
    PLAT_UI32 payload_length,
    PLAT_UI8 *pEnvelope,
    PLAT_UI32 envelope_length) {
    stse_ReturnCode_t ret;
    PLAT_UI8 working_kek[STSAFEA_KEK_KEY_SIZE];

    /* - Check stsafe handler initialization */
    if (pSTSE == NULL) {
        return (STSE_API_HANDLER_NOT_INITIALISED);
    }

    if (envelope_length < (payload_length + STSE_KEK_ENVELOPE_MAC_SIZE)) {
        return STSE_API_INVALID_PARAMETER;
    }

    ret = stse_derive_working_KEK(
        pSTSE,
        pSession,
        working_kek);

    if (ret != STSE_OK) {
        memset(working_kek, 0, STSAFEA_KEK_KEY_SIZE);
        return ret;
    }

    ret = stse_platform_nist_kw_encrypt(
        pPayload, payload_length,
        working_kek, STSAFEA_KEK_KEY_SIZE,
        pEnvelope, NULL);

    memset(working_kek, 0, STSAFEA_KEK_KEY_SIZE);

    if (ret != STSE_OK) {
        return (STSE_UNEXPECTED_ERROR);
    }

    return STSE_OK;
}